What we collect
For voters we use the stable account identifier supplied by Google or the deployment identity provider, account status, vote records, and security timestamps. A voter-only account does not need a stored email address. Participants also provide a display name, legal name, contact email, date of birth, country, biography, optional avatar, song metadata, declarations, and a performance video.
How we use it
Data is used to authenticate people, operate competitions, verify eligibility, prevent duplicate or fraudulent voting, moderate entries, publish approved videos, show results, investigate reports, and meet legal obligations. Public endpoints exclude legal name, email, date of birth, IP data, and administrative notes.
Video lifecycle
A selected video is previewed locally in the browser and is not transferred until the participant submits. The browser uploads directly to a private Cloudflare R2 bucket through a short-lived signed URL. Moderators use temporary private access. After successful YouTube publication, the original is scheduled for deletion following a short safety window.
Security and anti-fraud
VocalCrown may store keyed hashes of IP address and a minimal user-agent signal to identify unusual vote patterns. Raw IP addresses are not stored in vote records. Shared networks alone do not automatically invalidate votes.
Providers
The service may use Cloudflare for hosting, database, bot protection, analytics, and temporary storage; Google for identity; and YouTube for approved video hosting and playback. Advertising remains disabled until consent and jurisdiction requirements have been reviewed.
Retention and requests
Account, submission, vote, audit, and winner records are retained only for the period required for the competition, fraud protection, dispute handling, legal compliance, and published archives. Account access, correction, withdrawal, and deletion requests will be handled through the contact process named before public launch.
Launch details still required
The final policy must name the data controller, contact address, applicable countries, lawful bases, international transfer details, retention periods, and complaint authority.